DevRust Blogabout 1 month ago
Security Advisory for Cargo (CVE-2026-5222)
2 min read
CVE-2026-5222 allows credential theft via sparse registry URL normalization. Cargo incorrectly strips the.git suffix from sparse index URLs, enabling attackers to capture tokens. Rust 1.96, releasing May 28th 2026, fixes the issue. All Cargo versions from Rust 1.68 through 1.96 are affected.
Level
Hype check
Tap to vote and see what everyone thinks.
